Changeset 37646

Timestamp:

06/06/2016 09:33:30 PM (8 years ago)

Author:

rachelbaker

Message:

REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.

Move the REST API JSONP callback validation check into a separate function named wp_check_jsonp_callback(). This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with /**/. This will mitigate the Rosetta Flash exploit. You should also send the X-Content-Type-Options:nosniff header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)
• tests/phpunit/tests/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -3106 +3106 @@
 
 /**
+ * Check that a JSONP callback is a valid JavaScript callback.
+ *
+ * Only allows alphanumeric characters and the dot character in callback
+ * function names. This helps to mitigate XSS attacks caused by directly
+ * outputting user input.
+ *
+ * @since 4.6.0
+ *
+ * @param string $callback Supplied JSONP callback function.
+ * @return bool True if valid callback, otherwise false.
+ */
+function wp_check_jsonp_callback( $callback ) {
+    if ( ! is_string( $callback ) ) {
+        return false;
+    }
+
+    $jsonp_callback = preg_replace( '/[^\w\.]/', '', $callback, -1, $illegal_char_count );
+
+    return 0 === $illegal_char_count;
+}
+
+/**
  * Retrieve the WordPress home page URL.
  *

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -281 +281 @@
             }
 
-            // Check for invalid characters (only alphanumeric allowed).
-            if ( is_string( $_GET['_jsonp'] ) ) {
-                $jsonp_callback = preg_replace( '/[^\w\.]/', '', wp_unslash( $_GET['_jsonp'] ), -1, $illegal_char_count );
-                if ( 0 !== $illegal_char_count ) {
-                    $jsonp_callback = null;
-                }
-            }
-            if ( null === $jsonp_callback ) {
+            $jsonp_callback = $_GET['_jsonp'];
+            if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {
                 echo $this->json_error( 'rest_callback_invalid', __( 'The JSONP callback function is invalid.' ), 400 );
                 return false;

trunk/tests/phpunit/tests/rest-api.php

@@ -323 +323 @@
     }
 
+    public function jsonp_callback_provider() {
+        return array(
+            // Standard names
+            array( 'Springfield', true ),
+            array( 'shelby.ville', true ),
+            array( 'cypress_creek', true ),
+            array( 'KampKrusty1', true ),
+
+            // Invalid names
+            array( 'ogden-ville', false ),
+            array( 'north haverbrook', false ),
+            array( "Terror['Lake']", false ),
+            array( 'Cape[Feare]', false ),
+            array( '"NewHorrorfield"', false ),
+            array( 'Scream\\ville', false ),
+        );
+    }
+
+    /**
+     * @dataProvider jsonp_callback_provider
+     */
+    public function test_jsonp_callback_check( $callback, $valid ) {
+        $this->assertEquals( $valid, wp_check_jsonp_callback( $callback ) );
+    }
+
 }